CVE-2026-34082: 
Dify vulnerability analysis and mitigation

CVE-2026-34082 is an Insecure Direct Object Reference (IDOR) vulnerability in Dify, an open-source LLM application development platform, that allows any authenticated user to delete another user's chat conversation history without authorization. The vulnerability affects all Dify versions prior to 1.13.1 and was disclosed on April 20, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The vulnerability is rooted in improper access control (CWE-284) and incorrect authorization (CWE-863) in the DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> API endpoint. The endpoint fails to verify that the authenticated user making the DELETE request is the owner of the targeted conversation, constituting a classic IDOR flaw. An attacker can first issue a GET /console/api/installed-apps/<appId>/conversations request to enumerate conversation GUIDs belonging to other users, then use those GUIDs to issue unauthorized DELETE requests. No elevated privileges are required — any authenticated Dify user with any role can exploit this (GitHub Advisory).

Successful exploitation results in unauthorized deletion of other users' chat conversation history, causing permanent data loss and privacy violations. The impact is limited to integrity — there is no confidentiality breach (conversation content is not exposed) and no availability impact beyond the targeted data loss. In multi-tenant Dify deployments, a malicious insider or compromised account could systematically erase conversations across all users if conversation GUIDs are discoverable (GitHub Advisory).

A proof-of-concept exploitation sequence is publicly documented in the GitHub Security Advisory, including specific HTTP request formats and a reproducible step-by-step procedure. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, reflecting low but non-zero exploitation probability. No threat actor attribution has been reported (GitHub Advisory).

1. Authenticate to Dify: Log in to the target Dify instance as any authenticated user with any role.
2. Identify a target application: Navigate to an installed app (e.g., an agent-type app) at https://<dify-host>/explore/installed/<appId>.
3. Enumerate conversation IDs: Send a GET /console/api/installed-apps/<appId>/conversations request (observable via browser DevTools) to retrieve conversation GUIDs belonging to other users, if accessible, or obtain a target conversationId through other means (e.g., shared logs, API leakage).
4. Craft the DELETE request: As a different authenticated user, send the following HTTP request:

DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> HTTP/2
Host: <dify-host>
Cookie: access_token=<attacker_token>; csrf_token=<csrf_token>
X-Csrf-Token: <csrf_token>

5. Confirm deletion: Refresh the target application's conversation list to verify the victim's chat history has been deleted (GitHub Advisory).

• Network: Unusual DELETE requests to /console/api/installed-apps/*/conversations/* endpoints originating from user accounts that do not own the targeted conversations; high-frequency DELETE requests from a single account across multiple conversationId values.
• Logs: API access logs showing DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> requests where the authenticated user's account does not match the conversation owner; cross-referencing deleted conversation records against the requesting user's account ID.
• Application: Sudden disappearance of conversation history for users who did not initiate deletions; audit trail gaps in conversation records with no corresponding user-initiated delete action (GitHub Advisory).

Upgrade Dify to version 1.13.1 or later, which enforces ownership checks for conversation deletion APIs as part of its security updates (Dify Release). For environments unable to patch immediately, implement network-level access controls or a WAF rule to restrict or monitor DELETE requests to the /console/api/installed-apps/*/conversations/* endpoint pattern, and alert on requests where the authenticated user does not match the conversation owner. Reviewing API access logs for anomalous DELETE activity is recommended as an interim detective control (GitHub Advisory).